# Append tag in Elasticsearch using Logstash
**URL:** https://discuss.elastic.co/t/append-tag-in-elasticsearch-using-logstash/150161
**Category:** Logstash
**Created:** [September 27, 2018, 9:35am UTC](https://discuss.elastic.co/t/append-tag-in-elasticsearch-using-logstash/150161 "2018-09-27T09:35:11Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@georgeRD](https://discuss.elastic.co/u/georgeRD)
#### Post date: [September 27, 2018, 9:35am UTC](https://discuss.elastic.co/t/append-tag-in-elasticsearch-using-logstash/150161/1 "2018-09-27T09:35:11Z")
Hi all,
Quick question about tagging with Logstash. I am using the following filter:
filter {
mutate {
add\_tag =\> ["test"]
}
}
It appears that the add\_tag replaces any existing in tags field. Is there any way to append a tag?
I am using Logstash v6.2.1.
Thanks in advance.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 27, 2018, 10:21am UTC](https://discuss.elastic.co/t/append-tag-in-elasticsearch-using-logstash/150161/2 "2018-09-27T10:21:26Z")
`add_tag` appends tags. If you're not getting the tags you expect it's probably because of something else in your configuration.
---
### Author:  [@georgeRD](https://discuss.elastic.co/u/georgeRD)
#### Post date: [September 27, 2018, 2:42pm UTC](https://discuss.elastic.co/t/append-tag-in-elasticsearch-using-logstash/150161/3 "2018-09-27T14:42:26Z")
Thank you Magnus for the quick response. Below is my full configuration and output from logstash. The result I receive is that the tags field of the record is reset with the value I provide in the add\_tag option. As per below the tags field is not present in the event created by the jdbc input but exists in the document with the same id in elasticsearch. Could this be the reason?
**Logstash Configuration:**
input {
jdbc {
jdbc\_driver\_library =\> "mysql-connector-java-5.1.45-bin.jar"
jdbc\_driver\_class =\> "com.mysql.jdbc.Driver"
jdbc\_connection\_string =\> "jdbc:mysql://ip:port/schema?zeroDateTimeBehavior=convertToNull"
jdbc\_user =\> "user"
jdbc\_password =\> "password"
jdbc\_default\_timezone =\> "UTC"
statement =\> "SELECT 'account' AS 'record\_type', id AS 'record\_id' FROM table WHERE TRUE and id = 1880713"
}
}
```
filter {
mutate {
add_tag => ["test"]
}
}
output {
elasticsearch
{
hosts => ["localhost:9200"]
index => "index"
document_type => "record"
document_id => "%{record_type}_%{record_id}"
action => "update"
}
stdout { codec => rubydebug }
}
```
**Logstash output:**
(0.007000s) SELECT
'account' AS 'record\_type',
`id` 'record\_id'
FROM table
WHERE TRUE
and id = 1880713
{
"@timestamp" =\> 2018-09-27T14:36:25.191Z,
"record\_id" =\> 1880713,
"record\_type" =\> "account",
"@version" =\> "1",
"tags" =\> [
[0] "test"
]
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 27, 2018, 5:56pm UTC](https://discuss.elastic.co/t/append-tag-in-elasticsearch-using-logstash/150161/4 "2018-09-27T17:56:18Z")
I don't understand. I've read through your configuration a number of times and the only place where you're adding a tag is the mutate filter adding the "test" tag. Naturally the only tag the document will have in the end is the "test" tag.
---
### Author:  [@georgeRD](https://discuss.elastic.co/u/georgeRD)
#### Post date: [September 28, 2018, 8:49am UTC](https://discuss.elastic.co/t/append-tag-in-elasticsearch-using-logstash/150161/5 "2018-09-28T08:49:37Z")
Thanks Magnus for your response. I will try to explain the scenario we're testing as I believe it wasn't clear from my comments:
- Document with document\_id: account\_1880713 exists in Elasticsearch and has field tags populated
- In Logstash we perform a query using jdbc input filter and depending on the result, we would like to add a tag to the existing document in Elasticsearch, using an update action
- upon creating the event in Logstash we do not know the tags that exist already in Elasticsearch, What we are trying to achieve is to append to the existing list of the tags field.
Hope our use case is more clear now, let me know if you need any further info.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 28, 2018, 2:00pm UTC](https://discuss.elastic.co/t/append-tag-in-elasticsearch-using-logstash/150161/6 "2018-09-28T14:00:57Z")
Oh, you're upserting the document. I think you have two options:
- Use a scripted update. That's supported by the elasticsearch output but I'm not entirely sure you'll be able to use it in this case.
- Use an elasticsearch filter to fetch the current contents of the document. You can then add your changes on top and push the document back to ES.
---
### Author:  [@georgeRD](https://discuss.elastic.co/u/georgeRD)
#### Post date: [September 28, 2018, 2:31pm UTC](https://discuss.elastic.co/t/append-tag-in-elasticsearch-using-logstash/150161/7 "2018-09-28T14:31:03Z")
Many thanks Magnus, we'll test option 2.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 26, 2018, 2:31pm UTC](https://discuss.elastic.co/t/append-tag-in-elasticsearch-using-logstash/150161/8 "2018-10-26T14:31:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.